CVE-2026-113293 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome deployments on Windows systems should assess exposure to CVE-2026-113293. This includes IT and security teams for organizations using Chrome for browsing, as well as developers and administrators working with Chrome-based applications on Windows.

Why it matters

CVE-2026-113293 is a high-severity use-after-free vulnerability in Google Chrome's ANGLE component on Windows. Defenders should prioritize verifying and updating Chrome versions to prevent potential remote code execution inside the sandbox. This vulnerability's exploitation could lead to unauthorized code execution, data access, or service disruption. Immediate action is necessary to ensure Chrome is updated to version 156.0.8078.47 or later.

• Remote attackers could execute arbitrary code inside the Chrome sandbox, potentially leading to elevated privileges or lateral movement within an organization.
• Successful exploitation could result in unauthorized access to sensitive data or disruption of Chrome-based services.
• Defenders need to verify Chrome versions and ensure they are updated to 156.0.8078.47 or later to mitigate this vulnerability.
• The use-after-free vulnerability in ANGLE requires immediate attention to prevent potential sandbox escapes and code execution.

Technical summary

A use-after-free vulnerability exists in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome on Windows systems. This vulnerability, identified as CVE-2026-113293, allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was addressed in Chrome version 156.0.8078.47. The CVE Program and NVD records indicate a use-after-free vulnerability in ANGLE on Windows prior to Chrome version 156.0.8078.47. Official sources confirm the vulnerability's existence and provide details on affected versions.

Defensive priority

High

Recommended defensive actions

• Assess exposure to CVE-2026-113293 for Windows systems using Google Chrome, focusing on versions prior to 156.0.8078.47.
• Verify Chrome version and update to 156.0.8078.47 or later if necessary.
• Monitor for suspicious HTML page activity that could exploit the use-after-free vulnerability in ANGLE.
• Implement sandboxing and isolation measures for Chrome on Windows to limit potential impact.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE Program and NVD records indicate a use-after-free vulnerability in ANGLE on Windows prior to Chrome version 156.0.8078.47. Official sources confirm the vulnerability's existence and provide details on affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.